HCL AppScan (DAST)

HCL AppScan DAST is an enterprise dynamic application security testing solution and a core component of the HCL AppScan 360° platform.

Recognized as a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing, AppScan provides comprehensive runtime vulnerability detection for web applications and APIs with flexible deployment options including on-premises installations for air-gapped environments.

What is HCL AppScan DAST?

HCL AppScan DAST performs black-box security testing by crawling and attacking running web applications to discover vulnerabilities.

The scanner simulates real-world attack techniques to find SQL injection, cross-site scripting, authentication flaws, and other runtime security issues that static analysis cannot detect.

The tool evolved from IBM AppScan, which HCL acquired in 2019.

HCL has continued significant investment in the platform, introducing AI-enabled testing capabilities and modernizing the architecture for cloud-native deployment.

Key Features

AI-Enabled Scanning

AppScan uses machine learning to optimize test coverage and reduce scan times.

The AI engine learns application behavior patterns to focus testing on high-risk areas and reduce redundant test cases.

Smart crawling adapts to application structure for more thorough coverage.

AppScan 360° Platform

DAST is part of the unified AppScan 360° platform that includes SAST, IAST, SCA, IaC security, and API testing.

Findings from all scanners correlate in a single dashboard, providing complete application risk visibility.

The platform supports both cloud and on-premises deployment.

Compliance and Standards

AppScan maps findings to compliance frameworks including PCI DSS, HIPAA, GDPR, and SOC 2.

The FIPS 140-3 compliant option meets federal security requirements for U.S. government and contractor use cases.

Reports generate in formats suitable for auditor review.

API Security Testing

Beyond traditional web application scanning, AppScan tests REST and SOAP APIs.

Import OpenAPI/Swagger specifications or GraphQL schemas to automatically generate test cases covering authentication, authorization, and injection vulnerabilities in API endpoints.

Installation

Cloud Deployment

For AppScan on Cloud, no installation is required.

Create an account at the HCL AppScan portal and configure applications through the web interface.

On-Premises Deployment

AppScan Enterprise and Standard require installation on Windows servers or workstations:

# Download installer from HCL License Portal
# Run installer with administrative privileges
.\HCL_AppScan_Enterprise_Setup.exe

# Configure database connection and licensing
# Access web interface at https://server:9443/ase

Docker Deployment

# Pull AppScan Presence container for hybrid scanning
docker pull hclcr.io/appscan/appscan-presence:latest

# Run Presence agent to enable on-premises scanning from cloud
docker run -d \
  --name appscan-presence \
  -e APPSCAN_KEY=your-api-key \
  hclcr.io/appscan/appscan-presence

Integration

CLI Scanning

# AppScan CLI for automation
appscan.sh prepare -c config.xml

# Start scan
appscan.sh queue_analysis -a $APP_ID

# Download report
appscan.sh get_result -i $SCAN_ID -t html -o report.html

GitHub Actions

name: HCL AppScan DAST
on: [push]

jobs:
  appscan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run AppScan DAST
        uses: HCL-TECH-SOFTWARE/appscan-dast-action@v1
        with:
          asoc_key: ${{ secrets.APPSCAN_KEY }}
          asoc_secret: ${{ secrets.APPSCAN_SECRET }}
          application_id: ${{ secrets.APP_ID }}
          scan_type: 'staging'
          target_url: 'https://staging.example.com'

Jenkins Pipeline

pipeline {
    agent any
    stages {
        stage('Deploy to Staging') {
            steps {
                // Deploy application
            }
        }
        stage('DAST Scan') {
            steps {
                appscan(
                    scanner: 'dynamic',
                    name: 'Staging DAST',
                    target: 'https://staging.example.com',
                    application: 'MyApp',
                    credentials: 'appscan-creds'
                )
            }
        }
    }
}

Azure DevOps

- task: HCLAppScan@1
  inputs:
    scanType: 'dynamic'
    serviceConnection: 'AppScan Service'
    applicationId: '$(APP_ID)'
    targetUrl: 'https://staging.example.com'
    waitForResults: true

When to Use HCL AppScan DAST

HCL AppScan DAST fits enterprises requiring comprehensive runtime security testing with flexible deployment options.

The on-premises capability makes it suitable for regulated industries like finance, healthcare, and government where data cannot leave the network.

Organizations already invested in the HCL ecosystem benefit from the unified AppScan 360° platform, correlating DAST findings with SAST, SCA, and IAST results.

The Gartner Leader recognition reflects the platform’s maturity and enterprise capabilities.

Consider AppScan DAST when you need proven enterprise DAST with compliance reporting, federal security certification (FIPS 140-3), or the ability to run scans entirely on-premises.

For cloud-native organizations without strict data residency requirements, evaluate cloud-first alternatives like Bright Security or Invicti.